Privacy Policy

1. Information We Collect

We collect information you provide directly to us, as well as data generated automatically when you use the Service.

Account information

When you create an account, we collect:

• Email address
• Password (stored as a secure hash by our authentication provider; we never store your plaintext password)
• Username and display name
• Optional profile photo (avatar)
• Theme preference
• Confirmation that you accepted the Terms of Service and this Privacy Policy (with timestamps)

Messages and conversations

When you use chat features, we store:

• Message text you send, including direct messages and group chat activity
• GIF links you attach
• File attachment metadata (file name, type, size, storage path, expiry)
• Reply relationships between messages
• Read receipts (which messages you have opened)
• Conversation membership, including the Site Announcements channel
• Message request status for new direct messages (pending, accepted, or declined)

Files

Uploaded files, including images, are stored with a third-party object storage provider and are automatically set to expire (currently after about 30 days). Avatars are stored in public profile storage so other signed-in users can see them.

Notifications

If you enable push notifications, we store a device push subscription (endpoint and encryption keys) and a user-agent string so we can deliver notifications. You can turn this off at any time, and you can mute Site Announcements without leaving the channel.

Blocks and requests

If you block someone, we store that relationship so messaging can be prevented. Message request accept/decline actions are stored to enforce the one-message-until-accepted rule.

Technical and session data

We use session cookies so you stay signed in. Our servers and service providers may also record technical data such as IP addresses, browser types, device identifiers, log files, and timestamps, and operational errors (for example, failed notification deliveries), to keep the Service secure and working.

Third-party services

• Supabase — authentication, database, realtime updates, and avatar storage
• Object storage (e.g. Backblaze B2) — chat file attachments
• Giphy — GIF search when you use the GIF picker (search terms are sent through our proxy)

2. How We Use Your Information

We use your personal information solely to provide, secure, and maintain the Service. Specifically, we use it to:

• Create and secure your account, and authenticate logins
• Deliver direct messages, group messages, attachments, read receipts, message requests, and Site Announcements
• Show the People directory and conversation list to signed-in users
• Manage blocking, muting, and interaction restrictions between users
• Send optional push notifications
• Detect, investigate, and prevent unauthorized access, abuse, security incidents, or spam
• Operate, maintain, and improve the Service
• Comply with applicable legal obligations or respond to valid legal process

We do not sell, rent, or trade your personal information, and we do not use your messages or files for advertising or marketing. We do not use advertising trackers or analytics SDKs in the app as shipped today.

3. Information Sharing and Disclosure

Your information is shared only in the following limited circumstances:

• With other users: Other users can see your profile (username, display name, avatar) in People and shared chats. People in a conversation with you can see messages, attachments, GIFs, and read receipts there. Site Announcements are visible to all members of that channel.
• Third-party infrastructure providers: Service providers process data only as needed to host authentication, database and realtime services, file storage, and GIF search, and do so on our behalf to support site operations.
• Legal compliance and protection: We may disclose information if required by law, court order, or legal request, or to protect the safety, rights, or security of our users or the Operator.

4. Data Retention and Deletion

• Account and profile data are kept while your account exists
• Messages remain until deleted by the Operator or as part of account deletion
• Attachment files are intended to expire after a limited period (about 30 days)
• Push subscriptions are removed when you disable notifications, sign out, or they become invalid

If you request account deletion or remove specific content, residual copies may temporarily remain in database backups or server logs for a limited period before being permanently purged.

5. Children’s Privacy

The Service is not directed to children under 13 (or the minimum age required in your region), and we do not knowingly collect personal information from them. Do not create an account if you are under that age. If you believe a child has provided us with personal details, please contact us so we can remove the account and data.

6. Security

We use reasonable safeguards such as hashed passwords, authenticated sessions, and conversation access controls to protect your personal information from loss, unauthorized access, disclosure, or alteration. However, no method of transmission or storage is 100% secure.

7. Your Choices and Control

You can control your privacy and interaction settings within AvA Chat:

• Update your avatar and theme
• Enable or disable push notifications (also possible through your browser or device settings)
• Mute Site Announcements or individual channels
• Accept or decline message requests
• Block or unblock specific users
• Sign out at any time
• Contact the Operator to request account deletion or a copy of your data

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, the “Last updated” date at the top of this page will change, and we may also notify users through an in-app prompt, Site Announcement, or email. Continued use of the Service after changes take effect means you accept the updated policy where permitted by law.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how your data is handled, you may email nsharp@willamette.edu or message the administrator account directly on AvA Chat.